iframe里验证码错误的问题及解决

最新推荐文章于 2022-05-23 15:33:18 发布

原创最新推荐文章于 2022-05-23 15:33:18 发布 · 1.1k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#php #测试

本文详细阐述了在使用iframe从本域加载另一域的页面时，由于P3P标准导致的cookie无法保存问题。通过在设置session的地方输出特定的header解决了这一问题，适用于PHP、ASP.NET和JSP等技术栈。

工作中遇到的问题从本域A iframe另一个域的页面（是登录页）验证码总是提示错误 (IE下才有问题，因为那个页要activex 所以开始没怀疑session) 经过排查确定是iframe里的页面生成的cookie是保存不住的；

测试用例如下：
A域页面代码：
<iframe src="http://B/p3p.php"></iframe>

B域页面

<?php
session_start();
if(!empty($_GET['test'])){
var_dump($_SESSION['p3p']);
}else{
$_SESSION['p3p'] = 'room';
echo "<a href='?test=1'>test</a>";
var_dump($_SESSION['p3p']);
}
?>
IE下点击IFRAME里的链接打印出NULL
因为IE里iframe是不传输stored_cookie的
资料原文:
The problem lies with a W3C standard called Platform for Privacy Preferences or P3P for short. You can read all about the boring stuff via the link or else just install the P3P Compact Policy header below. This will allow Internet Explorer to accept your third-party cookie. You will need to send the header on every page that sets a cookie.

解决方法是输出个header

PHP:

header('P3P:CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"');

ASP.NET:

HttpContext.Current.Response.AddHeader("p3p","CP=/"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT/"");

JSP:

response.addHeader("P3P","CP=/"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT/"")

试验在设置session的地方输出header即可
.....
header('P3P:CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"');
$_SESSION['p3p'] = 'room';
.....

jsp response.addHeader("P3P","CP=CAO PSA OUR");